EC-Council Certified Incident Handler (ECIH)
EC-Council
EC-Council's incident handling and response certification covering the IH&R process across malware, email, network, web app, cloud, insider, and endpoint incidents.
We have a course for this
Built from this exam's published objectives. The first module is free.
What this qualifies you for
Listed specifically for 1 work role — up to Intermediate proficiency. Because options cascade downward, a cert listed at Advanced also satisfies Intermediate and Basic for that role.
Also listed for 14 Cyberspace Enablers roles — but so is every other certification
The Enablers matrix isn’t role-differentiated: the same certification options are listed for all 14 roles at every proficiency level. We verified that across all 14. So this is true, and it carries no information about this credential specifically — which is why it isn’t in the count above.
Renewal
USD $80 annual EC-Council Continuing Education (CE) membership fee (approx. $240 over the 3-year cycle), in addition to submitting 120 ECE credits
This is the issuer’s clock. 8140 runs a second one — 20 hours of CPD a year, at every proficiency level, which applies even if you hold no certification at all. How that works
EC-Council publishes the 10 modules/objective areas without percentage weights on the official course page; all domains are recorded as weight 0 (unweighted). The official course page did not state a passing score; EC-Council uses multiple exam forms with a per-form cut score. Third-party sources cite ~70%, but this is not confirmed on the official page. Version 'v3' (exam code 212-89) is the current form per the official course page and EDUSUM references.
Source: EC-Council - EC-Council Certified Incident Handler (ECIH) · dated 2026-07-17 · checked 2026-07-17
Verifying it
EC-Council publishes a lookup a third party can use without your involvement.
Candidate Name and Certification Number
EC-Council publishes the 10 modules/objective areas without percentage weights on the official course page; all domains are recorded as weight 0 (unweighted). The official course page did not state a passing score; EC-Council uses multiple exam forms with a per-form cut score. Third-party sources cite ~70%, but this is not confirmed on the official page. Version 'v3' (exam code 212-89) is the current form per the official course page and EDUSUM references.
Source: EC-Council - EC-Council Certified Incident Handler (ECIH) · dated 2026-07-17 · checked 2026-07-17
Exam blueprint
Verified against EC-Council’s published outline.
212-89 · v3
Current100 questions · 3 hours · passing score varies (cut score set per exam form; commonly cited ~70%)
EC-Council publishes objective areas without percentage weightings, so none are shown.
EC-Council publishes the 10 modules/objective areas without percentage weights on the official course page; all domains are recorded as weight 0 (unweighted). The official course page did not state a passing score; EC-Council uses multiple exam forms with a per-form cut score. Third-party sources cite ~70%, but this is not confirmed on the official page. Version 'v3' (exam code 212-89) is the current form per the official course page and EDUSUM references.
Source: EC-Council - EC-Council Certified Incident Handler (ECIH) · dated 2026-07-17 · checked 2026-07-17